270ffa8208
The agent, not the client, collects the FIDO PIN when signing with an agent-held verify-required `sk-ssh-ed25519` key. Its systemd user service started with a minimal env lacking `SSH_ASKPASS`, so those signatures failed as "incorrect passphrase supplied to decrypt private key". Set `SSH_ASKPASS` and `SSH_ASKPASS_REQUIRE=force` on the unit so the agent can pop pinentry. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>